What’s Vulnerable › Vulnerabilities

CVE-2021-42000: Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-10 · updated 2026-06-17
• Weakness: CWE-285

Description

When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.

Affected products

• Ping Identity PingFederate: through 9.3.0; from 10.0.0 through 10.0.11; from 10.1.0 through 10.1.8; from 10.2.0 through 10.2.6; from 10.3.0 through 10.3.2; 9.3.3, 9.3.3-p15

References

• https://docs.pingidentity.com/bundle/pingfederate-103/page/hhm1634833631515.html
• https://www.pingidentity.com/en/resources/downloads/pingfederate.html
• https://docs.pingidentity.com/bundle/pingfederate-103/page/hhm1634833631515.html
• https://www.pingidentity.com/en/resources/downloads/pingfederate.html

Get alerted when CVE-2021-42000 or the next vulnerability affects your stack